Minor Athlete Warranties
Strict Section 34/35 POPIA compliance with mandatory school parental consent warranties for athletes under 18.
Zero Data Monetization
We never sell, rent, or commercialize player performance or contact records to commercial advertisers or scouts.
Athletic Disclaimer
Performance benchmarking software, not a medical device. Training clearance remains the school staff's responsibility.
24h Auto-Purge Protocol
Automated database cleanup permanently purges completed action plans older than 24 hours for data minimization.
Policy Navigation Index
Jump directly to any section of the compliance framework
Scope, Identity & Legal Framework
This Privacy Policy governs the processing, security, and lifecycle management of personal information collected through the AcademyPro Performance Platform, comprising the Coach Mobile Application (iOS & Android), the Web Administration Portal (admin.academypro.co.za), backend API services, and the official website (academypro.co.za).
AcademyPro is operated in South Africa by CodeWays PTY LTD ("AcademyPro", "we", "us", or "our"). This policy is drafted in strict accordance with the Protection of Personal Information Act, Act No. 4 of 2013 (POPIA), the Promotion of Access to Information Act, Act No. 2 of 2000 (PAIA), the Children's Online Privacy Protection Act (COPPA), and international student privacy best practices.
This policy applies to all subscribing high schools, sports clubs, athletic directors, rugby coaches, medical and physiotherapy staff, student-athletes, and parents or legal guardians accessing AcademyPro platforms.
Institutional Roles: Responsible Party vs. Operator
Under South African law (POPIA Section 1) and global data protection regimes, legal accountability is bifurcated as follows:
Acts as the Responsible Party (Data Controller). The school determines legitimate athletic development purposes, manages student-athlete enrollments, and guarantees legal authorization.
Acts strictly as an Operator (Data Processor). We process and store athletic records exclusively pursuant to the school's authorized instructions and institutional SaaS agreement.
Minor Student-Athletes & Parental Consent Warranty
By registering student-athletes under 18 years of age on AcademyPro, the subscribing school or sports club expressly warrants and represents that it has secured verifiable written parental or legal guardian consent for the collection, logging, and processing of the child's personal, athletic, and physical conditioning information.
In accordance with Section 35(1) of POPIA, the prohibition on processing personal information concerning children does not apply where processing is carried out with the prior consent of a competent person (parent/legal guardian) or is necessary for the establishment, exercise, or defense of a right or obligation in law.
Categories of Data Collected & Processed
Under POPIA Condition 2 (Processing Limitation), we collect and process only the minimal data strictly necessary for athletic roster organization, performance auditing, training session coordination, and player safety:
Full legal name, preferred playing name, date of birth, age tier (U14, U15, U16, First XV), school grade, jersey number, playing positions (primary & secondary), profile photo, and institutional student identifier.
Parent/guardian name, verified primary mobile number (for emergency athletic notifications and SMS alerts), email address, and designated emergency contact status.
Coach full name, official school email, sport specialization (Head Coach, S&C Coach, Physiotherapist, Director of Sport), cryptographic password hash, and granular role permissions.
Training session timestamps, fixture participation records, QR code verification scans, and absence classifications.
Athletic Baseline Testing & Physical Benchmarks
AcademyPro allows strength and conditioning specialists to log athletic performance variables to monitor physiological progression:
Sprint & Speed Metrics
10m split, 20m acceleration, and 40m top-end sprint timings.
1RM Strength Benchmarks
Back squat, bench press, trap bar deadlift, and power clean.
Aerobic & Anaerobic Tests
1.2km Bronco shuttle test and Yo-Yo Intermittent Recovery splits.
Anthropometrics & Reach
Height (cm), body mass (kg), standing reach, and vertical jump.
Special Personal Information: Health & Injuries
Under Section 26 and Section 32 of POPIA, information concerning an individual's physical health or medical history constitutes Special Personal Information.
AcademyPro processes health status, active injury markers, physical readiness indicators, and medical clearance notes solely where authorized by the school's medical/physiotherapy staff for the direct purpose of protecting the athlete's physical well-being, preventing reinjury during high-impact rugby training, and coordinating graduated return-to-play protocols. Access is strictly restricted via Role-Based Access Control (RBAC).
Athletic Platform & Medical Liability Disclaimer
(a) Not a Medical Device: AcademyPro is an athletic record-keeping and team communication tool. It is NOT a medical device, diagnostic system, or licensed healthcare provider. Baseline metrics, Bronco scores, and 1RM tracking algorithms are informational benchmarks and do not substitute for qualified medical judgment.
(b) School Supervision: The subscribing school, sports directors, and accredited coaching staff maintain sole responsibility for ensuring athletes are medically cleared to perform physical conditioning tests and participate in contact rugby fixtures.
Lawful Grounds for Processing (POPIA Section 11)
Under Section 11 of POPIA, personal information may only be processed if a specific lawful basis applies:
Fulfilling our SaaS licensing agreement with the subscribing high school or athletic organization.
Verifiable written consent provided by parents/guardians during school enrollment or team registration.
Fostering student athletic progression, injury prevention, and institutional sports management.
Emergency field-side scenarios where designated parents or paramedics must be notified immediately.
Automated Purging & Data Retention Standards
To minimize data retention in accordance with Section 14 of POPIA, AcademyPro implements rigorous lifecycle standards:
When an individual athlete Action Plan is marked as complete (is_completed = 1), the system automatically timestamps completion and permanently purges the record after 24 hours (86,400 seconds) to ensure temporary notes are not stored unnecessarily.
Zero Selling of Data & Authorized Operators
We do NOT sell, rent, monetize, or disclose student or coach personal information to third-party commercial advertisers or data brokers under any circumstance.
| Operator Category | Operational Purpose | Security Safeguards |
|---|---|---|
| Cloud Infrastructure (Cloudflare) | D1 database hosting, automated backups, TLS 1.3 edge security | ISO 27001, SOC 2 Type II, AES-256 at rest |
| Transactional SMS Gateway | Dispatching emergency fixture alerts to parent mobile phones | Encrypted API transmission, zero marketing use |
| Transactional Email Service | Delivering coach onboarding invitations and password recovery | DKIM/SPF authenticated, TLS in transit |
Technical & Cryptographic Security Safeguards
AcademyPro incorporates defense-in-depth technical and organizational measures to safeguard records:
All mobile app and web portal traffic is strictly enforced over TLS 1.3 encryption. At-rest databases are AES-256 encrypted.
100% prepared SQL statements with parameterized variable bindings (.bind()) across all endpoints.
Granular permission isolation between athletic directors, rugby coaches, medical staff, and age-group managers.
Cryptographically signed JSON Web Tokens with strict session expirations. Zero plaintext credential logging.
Institutional Offboarding & Permanent Deletion
Upon termination of an institution's subscription or upon receipt of an authorized deletion request from a school's athletic director:
- The school is provided with a 30-day export window to download all squad test baselines, sprint splits, and attendance audits.
- Following the export window, all identifying student records, emergency phone numbers, and profile photos are permanently purged from live production databases.
Your Data Subject Rights Under POPIA
Parents, legal guardians, and coaching staff retain statutory rights under Chapter 3 of POPIA:
Request confirmation of whether we hold personal information and request a copy of such record.
Request the correction, completion, or updating of inaccurate or outdated athlete data.
Object on reasonable grounds to the processing of personal information where processing is based on legitimate interest.
Lodge a complaint with the South African Information Regulator if you believe your privacy rights have been infringed.
Information Officer & Regulatory Contacts
If you are dissatisfied with our response to your inquiry, you have the right to lodge a formal complaint with the South African Information Regulator: